T08 · Insecure Dependencies
- Location
SKILL.md:249- Finding
Unpinned WaveSpeed CLI Package Is Executed Through npx
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:249-255references/brand-hallucination-fix.md:31-39
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
SKILL.md:249-255:bash URL=$(npx @wavespeed/cli upload ./generated.png --json | jq -r .url) # 2. Edit to remove branding PROMPT="Remove all text and brand logos from the image. Keep everything else identical — same lighting, pose, composition, colors. Clean unbranded surface." npx @wavespeed/cli run bytedance/seedream-v4.5/edit \ -i prompt="$PROMPT" \ -i images="[\"$URL\"]" \ --json --download "./clean-{index}.{ext}"references/brand-hallucination-fix.md:31-39:bash URL=$(npx @wavespeed/cli upload ./image.png --json | jq -r .url) # Targeted removal (be SPECIFIC about which object) PROMPT="Remove all text and brand logos from the [SPECIFIC OBJECT]. Keep everything else identical — same lighting, pose, composition, colors." npx @wavespeed/cli run bytedance/seedream-v4.5/edit \ -i prompt="$PROMPT" \ -i images="[\"$URL\"]" \ --json --download "./clean-{index}.{ext}"Technical Analysis
Both documented workflows invoke
npx @wavespeed/cliwithout specifying an exact package version or verifying package integrity. Depending on the local npm configuration and cache state,npxcan retrieve the package from the configured registry and immediately execute its code.Consequently, the code that runs is not fully determined by the audited skill contents. A compromised package release, package ownership takeover, registry compromise, or malicious registry configuration could cause an altered version of the CLI to execute when a user follows these instructions. The package's CLI implementation and applicable package lifecycle behavior execute with the permissions of the user running
npx.This is a supply-chain weakness rather than evidence that the cur ...[truncated 1597 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin the CLI to an exact, reviewed version in every command, for example:
bash npx --yes @wavespeed/cli@<audited-exact-version> upload ./generated.png --json -
Prefer installing the dependency through a committed
package.jsonand lockfile, then execute the locked local binary withnpm exec --offlineor an equivalent mechanism that does not silently resolve a new release. -
Verify the package source, publisher, provenance, and registry integrity metadata before approving a version. Update only through a controlled dependency-review process.
-
Configure npm to use an explicitly trusted registry and prevent project or user configuration from silently redirecting the scoped package to an untrusted source.
-
Where compatible with the package, suppress unnecessary installation scripts and test the workflow in an isolated environment before production use.
-
Run image-processing commands in a least-privilege container or sandbox with:
- No unrelated credentials in environment variables.
- Read access limited to required input images.
- Write access limited to a dedicated output directory.
- Outbound network access restricted to required WaveSpeed endpoints.
-
Apply the same pinned version and verification guidance consistently in both
SKILL.mdandreferences/brand-hallucination-fix.md.
-